Difference between revisions of "Auto Assembler:alloc"
Jump to navigation
Jump to search
m |
|||
| Line 2: | Line 2: | ||
'''Auto Assembler''' alloc(''SymbolName'', ''Size'', ''AllocateNearThisAddress'' OPTIONAL) | '''Auto Assembler''' alloc(''SymbolName'', ''Size'', ''AllocateNearThisAddress'' OPTIONAL) | ||
| − | Allocates a | + | Allocates a memory block of ''Size'' bytes and defines the ''SymbolName'' in the script, pointing to the beginning of the allocated memory block. |
| − | If 'AllocateNearThisAddress' is specified CE will try to allocate the memory near | + | If the optional parameter ''AllocateNearThisAddress'' is specified then the CE will try to allocate the memory near to this address (this is useful for 64-bit targets where the jump distance could be bigger than 2GB otherwise). |
| − | |||
Note: Use [[Auto Assembler:dealloc|dealloc]] to free the memory when done. | Note: Use [[Auto Assembler:dealloc|dealloc]] to free the memory when done. | ||
| − | Note2: There are 2 other alloc variants | + | Note2: There are 2 other alloc variants: allocnx and allocxo. allocnx will allocate memory as non-executable. allocxo will allocate memory as execute only. |
=== Command Parameters === | === Command Parameters === | ||
| Line 55: | Line 54: | ||
00410000: | 00410000: | ||
| − | mov [ | + | mov [memloc1],esi |
mov [esi+80],ebx | mov [esi+80],ebx | ||
xor eax,eax | xor eax,eax | ||
Revision as of 14:27, 22 April 2022
Auto Assembler alloc(SymbolName, Size, AllocateNearThisAddress OPTIONAL)
Allocates a memory block of Size bytes and defines the SymbolName in the script, pointing to the beginning of the allocated memory block. If the optional parameter AllocateNearThisAddress is specified then the CE will try to allocate the memory near to this address (this is useful for 64-bit targets where the jump distance could be bigger than 2GB otherwise).
Note: Use dealloc to free the memory when done.
Note2: There are 2 other alloc variants: allocnx and allocxo. allocnx will allocate memory as non-executable. allocxo will allocate memory as execute only.
Command Parameters
| Parameter | Type | Description |
|---|---|---|
| SymbolName | string | The symbol name to use for allocated memory |
| Size | integer | The byte size of the block of memory to allocate |
| AllocateNearThisAddress | string | The address to allocate near if given |
Examples
alloc(SomeSymbol, 0x4)
alloc(SomeSymbol, 0x1000)
alloc(SomeSymbol, $1000)
alloc(SomeSymbol, 0x4, Tutorial-x86_64.exe+164C2)
- From the SunBeam: CE actually fetches the module and allocates close to the end of the module. Additionally specifying +164C2 does not add to it in any way :D Jus' sayin' Tutorial-x86_64.exe is enough.post
alloc(SomeSymbol, 0x4, SomeAOBSymbol)
alloc(SomeSymbol, 0x1000, Tutorial-x86_64.exe)
alloc(SomeSymbol, $1000, Tutorial-x86_64.exe)
alloc(memloc1,4) 00451029: jmp 00410000 nop nop nop 00410000: mov [memloc1],esi mov [esi+80],ebx xor eax,eax jmp 00451031
